SychicBoy / NETReactorSlayer

An open source (GPLv3) deobfuscator and unpacker for Eziriz .NET Reactor
https://www.CodeStrikers.org
GNU General Public License v3.0
930 stars 216 forks source link

Decryption failed #67

Open mbv opened 1 year ago

mbv commented 1 year ago

MethodDecrypter failed:

image

Seems it encrypted using .net reactor 6.9.0.0. For decrypting necrobit it using DecrypterV2 it cannot fetch DecryptionKey and DecryptionIV:

Screenshot 2023-03-12 at 16 33 37

Main method seems have Control Flow Obfuscation via goto:

image

It cannot fetch DecryptionKey and DecryptionIV, because these arrays declaration not liner, it also obfuscated:

image

When we tried deobfuscate this Control Flow Obfuscation code:

image

It replaced a little equations. And code looks better, but also contains "proxy" boolean methods:

image image
ex1dreamer commented 10 months ago

same issue. necrobit decriptor fails with following error: [ERROR] An unexpected error occurred during decrypting methods. Invalid argument value.